Vulnerability DatabaseCVE-2013-2251
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2013-2251
July 18, 2013
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.
Related Resources (22)
https://github.com/apache/struts/commit/3cfe34fefedcf0fdcfcb061c0aea34a715b7de6
http://www.securitytracker.com/id/1029184
http://www.securityfocus.com/bid/64758
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-2251
https://github.com/apache/struts/commit/630e1ba065a8215c4e9ac03bfb09be9d655c2b6e
https://github.com/apache/struts
http://archiva.apache.org/security.html
http://seclists.org/oss-sec/2014/q1/89
http://www.fujitsu.com/global/support/software/security/products-f/interstage-bpm-analytics-201301e.html
https://nvd.nist.gov/vuln/detail/CVE-2013-2251
http://www.securityfocus.com/bid/61189
http://cxsecurity.com/issue/WLB-2014010087
http://www.securitytracker.com/id/1032916
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2
http://packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Execution.html
http://seclists.org/fulldisclosure/2013/Oct/96
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
http://struts.apache.org/release/2.3.x/docs/s2-016.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/90392
https://issues.apache.org/jira/browse/WW-4140
http://osvdb.org/98445
Do you need more information?
Contact Us
CVSS v4
Base Score:
9.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
Exploit Maturity
ATTACKED
CVSS v3
Base Score:
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Exploit Maturity
HIGH
CVSS v2
Base Score:
9.3
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
Weakness Type (CWE)
Improper Input Validation
CWE-20
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-74
EPSS
Base Score:
94.33